Kimsuky Group Weaponizes AI Deepfakes in New Spear-Phishing Campaign

The Genians Security Center (GSC) has uncovered a new spear-phishing campaign by the North Korean threat group Kimsuky, detected on 17 July 2025 and attributed to their use of artificial intelligence in cyberattacks. The campaign impersonated a South Korean defence-related institution, masquerading as if it were managing official ID issuance tasks for military-affiliated personnel.

According to GSC, “the threat actor used ChatGPT, a generative AI, to produce sample ID card images, which were then leveraged in the attack,” demonstrating the group’s application of deepfake technology.

Victims who opened the attachments executed obfuscated PowerShell commands, establishing communication with a command-and-control (C2) server at jiwooeng.co[.]kr, with a malicious .zip archive containing a decoded PowerShell backdoor and a counterfeit government ID flagged by TruthScan as 98% likely to be a deepfake. South Korea’s Ministry of Foreign Affairs has warned that hiring or outsourcing to North Korean IT workers carries risks ranging from IP theft to reputational damage.